The effect of multi-pair signal states in quantum cryptography with entangled photons 
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Real sources of entangled photon pairs (like parametric 
down conversion) are not perfect. They produce quantum 
states that contain more than only one photon pair with some 
probability. In this paper it is discussed what happens if such 
states are used for the purpose of quantum key distribution. 
It is shown that the presence of "multi-pair" signals (together 
with low detection efficiencies) causes errors in transmission 
even if there is no eavesdropper. Moreover, it is shown that 
even the eavesdropping, that draws information only from 
these "multi-pair" signals, increases the error rate. Informa- 
tion, that can be obtained by an eavesdropper from these 
signals, is calculated. 
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I. INTRODUCTION 

The only evincibly secure method of communication 
with guaranteed privacy is Vernam cipher (or one-time 
pad) ||l|. It requires both communicating parties share a 
secret key of the same length as the message. Quantum 
key distribution (QKD) is a technique to provide two par- 
ties with such a secure, secret and shared key. The first 
complete protocol for QKD was given by Bennett and 
Brassard g] (BB84) following Wiesner's ideas g. The 
essence of this protocol is that if non-orthogonal quantum 
states are used for communication and a channel transmit 
them perfectly then eavesdropping is detectable. Later a 
different protocol, inspired by Bell's inequalities, was pro- 
posed by Ekert Q. It relies on nonclassical correlations 
or entanglement of two quantum particles. Its simplified 
( "BB84-like" ) version works as follows: Let us suppose 
two communicating parties, Alice and Bob, share a set 
of entangled pairs (|F)^ \V) g + |i?)^ \H)g)/y/2, where 
\V) and \H) are two orthonormal states of each particle 
- e.g., vertical and horizontal linear polarizations of pho- 
tons. Alice and Bob choose randomly and independently 
between two conjugated polarization bases - e.g. between 
basis {V,H} ("+") and the "diagonal" basis ("X") ro- 
tated by 45° with respect to it. Following a public dis- 
cussion about the basis of the measurement apparatuses, 
Alice and Bob can obtain a shared key made up from 
those signals where the measurement devices give corre- 
lated results. This is so called sifted key. 

Photon pairs with correlated polarizations can be pre- 
pared, e.g., by parametric down conversion of type II |^] 
or using two down-conversion crystals with phase match- 
ing of type I ra]. Unfortunately, these techniques never 



produce exactly one pair of photons. Quantum states 
generated by the both above mentioned down-conversion 
methods should be the same in principle. However, 
the system with two non-linear crystals is perhaps more 
graphical for our purposes. The orientation of the op- 
tical axes of two identical crystals are mutually perpen- 
dicular. With a vertically (horizontally) polarized pump 
beam down-conversion will only occur in the first (sec- 
ond) crystal, respectively. A 45°-polarized pump photon 
will be equally likely to down-convert in either crystal. 
Let us suppose two spatial modes with two fixed frequen- 
cies fulfilling phase-matching conditions. One is aiming 
to Alice, the other to Bob. The first crystal generates 
beams with vertical polarizations, the second one with 
horizontal polarizations. Quantum state generated by 
one crystal can be described |^] atj^ 
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proportional to non-linear susceptibility and pump power 
and t being interaction time.0 The total quantum state 
originating from the both crystals is theri|^ 
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where the subscripts V and H denote modes with vertical 
polarization (produced by the first crystal) and horizon- 
tal polarization (coming from the second crystal), respec- 
tively. The mean number of pairs is 



25' 



(3) 



^Of course, this is just an approximation because more then 
only two modes are always present in real cases. If the number 
of signal or idler modes is effectively infinite then the total 
number of photons in signal or idler beam, respectively, obeys 
Poissonian statistics. 

^It has good physical meaning only for pulse-pumped down 
conversion. Then it may be limited to infinity. 

■^We neglect a slight decrease of the pump power behind the 
first crystal. 



1 



The presence of more than one pair (or more than one 
photon in "single-photon" protocols) in the signals may 
enable eavesdropper (Eve) to get some information on 
the cryptographic key without causing any error. Thus 
she can learn something about the key but stay undis- 
closed. Similar difficulties implied by the use of weak 
coherent states in combination with lossy lines has been 
pointed out earlier [p|-pT|. A comprehensive analysis of 
security aspect of practical quantum cryptosystems tak- 
ing into account the source imperfections were done in 
Ref. |12|. But the role of down-conversion sources was 
reduced just to the preparation of approximate single 
photon states there. In the present paper we want to 
go beyond this limitation. 

The article is organized as follows. In Sec. |l| we ex- 
plain, on a simplified signal state containing at most 
two pairs of photons, why errors appear in QKD. Im- 
perfect detection efficienc y an d losses on the line are 
taken into account. Sec. Ill contains the comparison 



of the amount of information that can be obtained by 
Eve from multi-pair or multi-particle signals (by means 
of photon- number-splitting attack ) for different cryp- 
tographic schemes. Particularly for quantum cryptogra- 
phy using entangled photons, weak coherent states, and 
down-conversion "single-photon" sources. In Sec. IV we 



briefly discuss restrictions on Eve's activity stemming 
from monitoring both the data rate and the "double- 
click" rate (both detectors corresponding to logical 1 and 
fire together). Sec. |^ concludes the article with a short 
summary. 
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FIG. 1. Arrangement for QKD. State preparer, situated at 
Alice's side, generates signal states Both Alice and Bob 
have detectors that cannot distinguish the number of imping- 
ing photons and whose detection efficiencies are tja and rjB, 
respectively (this is indicated by circles in the figure). Alice 
and Bob change between two orientations of their polariza- 
tion analyzers: -|- and X . Both communicating parties are 
connected by quantum channel with transmittance rjL- This 
channel is accessible to Eve. 



II. ERRORS IN QKD DUE TO IMPERFECT 
SIGNAL STATES 

Consider configuration for QKD as in Fig. |l]. Let us 
suppose that g ^ 1 so that in Eq. (||) we can neglect all 
terms containing more than two pairs: 

I*) =e[|0,0,0,0)+g(|0,0,l,l) + |l,l,0,0)) 



+ |0, 0, 2, 2) + |2, 2, 0, 0) + |1, 1, 1,1))+ 0{g^)] . (4) 
Here we have used notation 
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with at being creation operators in corresponding modes. 

In the diagonal basis X , represented by the following 
creation operators 



at 



4)/^/2, 
(at, - at,)/V2, 



(6) 



state (Q) does not change its form. It can be shown that 
even the full state (^ is invariant under such transfor- 
mations of bases (the same transformation at the both 
sides). 

Losses on the channel and non-perfect efficiency of Al- 
ice's and Bob's detectors are modeled by beam splitters 
with intensity transmittances rj^, tja, and rjB, respec- 
tively. All the detectors are assumed to be "yes/no" de- 
tectors, which either fire or do not fire - they cannot 
distinguish the number of impinging photons. They may 
be described by the pair of projectors: Pno — |0)(0| -I- 
EZii^ -Vr\n){n\ and P,es = EZii^ ~ ~ vUn) {nl 
where ?7 is a detector efficiency. We neglect any noise. 

We intend to show that if the detector efficiencies are 
lower than 100 % the use of signal states (^ causes errors 
in the sifted key inevitably. Therefore we are interested 
only in that cases when Alice and Bob have set the same 
polarization bases. Of course, Alice and Bob include to 
the key only that events when exactly one detector fires 
at each side. The average relative length of the sifted key 
(with respect to the number of all generated entangled 
states) is then given by the formulan 



-Rkoy ~ £,^g^{vAVBVL 

+ g' [l-il-VAf] [1-{1-VBVL?] 
+ 2g^r]A{l - tia) riBVLi^ - iIbVl)}- 



(7) 



On the other hand, the relative number of errors (i.e. 
events when Alice gets a bit different from that detected 
by Bob) is 



-Rorr ~ ^^5'^?7a(1 - Va) VBllLil - VBVl)- 

Thus the error rate reads 

_ Rcir g'^i^-rjA-VBriL+riAriBVL) 



(8) 



-Rkoy i+g^{G-4:i]A-4:T]BriL+3rjAriBilL) 
(1 - ?7a)(1 - VbVl) 



(9) 



*It is taken into account that only one half of Alice's and 
Bob's bases coincide in average. 
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Clearly, if 77^1 —> 1 then e ^ for all mean pair numbers 
/X. So Alice should have as good detectors as possible. 
At Bob's side the crucial limitation would probably be 
represented by a low line transmission rjL for real systems. 
If T]L < 77A, Vb then e « (1 - tja) 



III. INFORMATION LEAKED TO EVE 

Let us suppose now that Eve will try to get some infor- 
mation on the key only from "multi-particle" (or "multi- 
pair") signals in order not to make any errors in trans- 
mission. She will be allowed to use the most efficient indi- 
vidual attack of this kind - the photon-number-splitting 
(PNS) attack She substitute a lossy line by a lossless 
one. Then she measures the total number of photons in 
incoming signals. If this number is higher than one she 
extracts and store one photon (or more) . The rest is sent 
to Bob by her. It is also supposed that she can control 
Bob's detection efficiency, so that Bob always get it. If 
the number of incoming photons is equal to one she ei- 
ther blocks the signal or passes it without other changes 
to Bob (in order not to decrease the data rate) . After the 
public comparison of Alice's and Bob's bases she makes 
a polarization measurement on the stored photons. 

The average Eve's information about sifted-key bits is 

[l+paog2P» + (l-p»)log2(l-pO], (10) 

i 

where is a portion of bits that Eve knows with prob- 
ability Pi; — ^- If knows r per cent bits for 
certain and she has no idea about the others then simply 
Ie = r. 



A. Weak coherent states 

First let us look at the case of quantum cryptography 
with weak coherent states (WCS) . The expected average 
relative length of the sifted key (i n proportion to the 
number of all sent signals) is ||lO| , [l^ 

^exp = ^ [1 ~ exp(-77i?7B^')] ' 

where /x' is a mean photon number in a signal state, rjB 
denotes Bob's detector efficiency. The average relative 
number of "multi-photon" signals is given by the formula 

i?muiti = i [1 - (1 + exp(-/i')] • 

Eve can learn all the bits stemming from these "multi- 
photon" signals with certainty. Thus the information 
leaked to Eve reads 



1 



(WCP) 
E 



R 



multi 



if ^oxp < -Rmulti, 
1 . (11) 

/i', otherwise. 



cxp 



B. Parametric down conversion 

Now, what information may leak to Eve if a paramet- 
ric down-conversion (PDC) source of "single" photons is 
used instead of laser producing coherent states? Gener- 
ated signal states (with fixed polarizations) are used for 
BB84 QKD-protocol in the exactly same manner as WCS 
]l2[ . The source consist of a single down-conversion crys- 
tal generating state (|^) and a "yes/no" detector (with an 
efficiency 77^) placed in one of the two output modes. 
A click on this detector means that the signal state has 
been prepared at the other mode. The expected aver- 
age relative length of the sifted key (in proportion to the 
number of all generated entangled states) is given by the 
formula 



Rc 



[l-il-r^AT] [1-(1 



VlVb) 



n=0 



The average relative number of "multi-photon" signals 
reads 

i?multi= VE5'"[1-(1-^a)"]. 



Again, Eve can learn all the bits carried by the "multi- 
photon" signals with certainty. After some straightfor- 
ward calculations one can find the amount of information 
leaked to her]^ 



.(PDC) _ 



R 



multi 



R. 



if ^cxp — -^multi i 



-/i , otherwise. 



(12) 



cxp 



were we have used the fact that in the case under con- 
sideration the mean number of pairs in each generated 
entangled state is /z" =5^/(1 — 5^)- 



C. Entangled photons 

Finally let us look at the cryptographic scheme fully 
based on entanglement of photon polarizations (EP); see 
Fig. |l|. Signal states are described by Eq. (^. All the 
detectors are "yes/no" ones again; on Alice's side they 
have efficiencies rjA, on Bob's side 775. 

Here the situation is more complex. It becomes impor- 
tant how many photons Eve separates. However, we will 
confine ourselves only to the simplified situation when at 
most to pairs are present with a reasonable probability 
[see Eq. (^]. Then Eve can separate no more than one 
photon and send remaining one to Bob. In contrast to 



^It can be done exactly but for our purposes the shown ap- 
proximation is good enough. 
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the both cases described above, now the information Iae 
that Eve shares with AHce is different from the informa- 
tion Ieb that she shares with Bob. This is connected 
with the occm'rence of errors in transmission. 

The expected rate of sifted-key generation is given by 
Eq. (^: -Rcxp = ^kcy A portion of two-photon signals 
leaving Alice's terminal - that signals that can be read 
by Eve applying PNS attack - is 

-Rdoubic = { [i - (1 - mf] + Va{1 -riA)}. 

The first term represents contributions from states 
|0,0,2,2) and |2,2,0,0) the second one from |1, 1,1,1). 
Only when exactly one detector clicks the bit is accepted 
to the key. 

Calculating information it must be taken into account 
that now Eve does not know all measured bits with cer- 
tainty. She cannot distinguish the signals stemming from 
states |1, 1, 1, 1) from the other two-photon signals. And 
for these particular signals she hits Alice's bit only with 
probability 50 % and Bob's bit values are even always 
opposite to hers. Thus Eve's average information is 



r(EP) 



^double 



if i?cxp < Rdo 



iblc; 



3-2?7^ 



fipj) iJi, otherwise, 



(13) 



where j — AE,EB and f{pj) = 1 + Pjlog2Pj + (1 — 
Pj) log2(l — Pj)- Probabilities that Eve knows Alice's (or 
Bob's) bit, respectively, are given by the ratio of success- 
ful results to all results: 



PAE 



5 - 3t?a 

6 - 4r?A ' 



PEB 



VA 



Clearly, f{pEB) < f{PAE) < 1 for 77^ < 1 and then 
also Ieb < Iae < 1- Unfortunately, the fact that 
the maximum Eve's information [see Eq. (13)] is lower 
than unity (if tja < does not represent any real ad- 
vantage because for i?oxp < ^i^doubio information Iae is 
equal to information shared by Alice and Bob, Iab = 
1-f e'log2 e' + (l-e') log2 (!-£')■ 

Notice the other important feature of PNS eavesdrop- 
ping in EP systems which is similar to "single particle" 
attacks: If Eve applies PNS attack by the way described 
above, i.e. if she tries to reproduce only the transmission 
rate (i?exp), she increases the error rate. The reason is 
that she increases the portion of |1, 1, 1, 1) contributions 
to the key bits. Clearly, this portion gets the following 
value: i?err^ = ^^5'*77a(1 — '7a)/2. Thus due to eavesdrop- 
ping the error rate grows to 



1 Lerr 



1 - ?7A 



-Rdoubio 6 - 'ir]A 



if -Rcxp < Rd: 



R_ 



1 - ??A 



p. 



oublc 7 



otherwise, 



(14) 



The increase of error rate can help to detect an eaves- 
dropper what is impossible in the analogous situation 
(PNS attack) with WCS and PDC systems. 



IV. HOW TO RESTRICT EVE'S ACTIVITY 

In the previous section Eve was restricted by the de- 
mand to reproduce transmission rate (average number of 
sifted-key bits) only. However, it is not the only quantity 
which could be monitored by Bob. In all the mentioned 
techniques Bob can also measure the double-click rate in 
that events when he used a different basis than Alice. In 
case of EP Bob can even monitor double-click rate in sit- 
uations with coincident bases (and, of course, the error 
rate). Clearly such Bob's activities pose other important 
restrictions to Eve jl^]. Even more possibilities are of- 
fered by passive arrangement, when Alice and Bob do 
not change bases actively (see, e.g., Ref. H). 



V. CONCLUSIONS 

We discussed the effect of "multi-pair signals" , that in- 
evitably appear in any system with a parametric-down- 
conversion source, on the security of quantum cryptogra- 
phy. We have shown that there is an important difference 
between the quantum-cryptographic setup that uses such 
a source just as a "triggered source of photons" and that 
which employs the entanglement of pairs of generated 
signals directly for quantum key distribution. In the lat- 
ter case there is a still nonzero error rate even if there 
is no eavesdropper. This is caused by the joint effect of 
the occurrence of "multi-pair signals" and of low detec- 
tion efficiencies. However, the most important result is 
that in the latter setup an individual eavesdropping on 
"multi-pair signals" increases the error rate in the trans- 
mission. 
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